CVE-2021-3119: 
NixOS vulnerability analysis and mitigation

Zetetic SQLCipher 4.x before 4.4.3 contains a NULL pointer dereferencing vulnerability (CVE-2021-3119) discovered in March 2021. The issue is related to sqlcipher_export in crypto.c and sqlite3StrICmp in sqlite3.c components. This vulnerability affects all versions from 4.0 up to (excluding) 4.4.3 (NVD).

The vulnerability stems from a NULL pointer dereferencing issue in the sqlcipher_export function in crypto.c and sqlite3StrICmp in sqlite3.c. The CVSS v3.1 base score is 7.5 (HIGH), with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-476 (NULL Pointer Dereference) (NVD).

When exploited, this vulnerability can allow an attacker to perform a remote denial of service attack. For example, an SQL injection can be used to execute crafted SQL command sequences, which results in a segmentation fault, potentially disrupting service availability (NVD).

The vulnerability can be exploited remotely without requiring authentication or user interaction. An attacker can trigger the vulnerability through SQL injection by executing specifically crafted SQL command sequences (NVD).

The vulnerability has been patched in SQLCipher version 4.4.3. Users are advised to upgrade to this version or later to mitigate the risk. The fix involves proper handling of NULL parameters in the sqlcipher_export function (GitHub Patch).